If you let a coding agent run commands, the question that matters is “what happens when it tries to get out?” On October 15, Perplexity released SPACE (Sandboxed Platform for Agentic Code Execution), the sandbox it uses internally for its agents, as open source. I’m drawing on AI Weekly, Semafor, AlphaSignal and a Digg summary of Perplexity’s announcement. I haven’t run it, and the test results are Perplexity’s own.

What it is

  • License: Apache 2.0. Repo: perplexityai/SPACE per AlphaSignal (I haven’t opened it).
  • Architecture: each sandbox runs in a Firecracker microVM called the “guest,” on a “host.” The agent gets root inside the guest. Credentials and network policy stay on the host side.
  • Network: a per-sandbox gateway enforces egress rules, and platform-managed credentials are brokered through it so the guest never reads raw secrets.
  • Snapshots: memory, disk and file state can be checkpointed, storing only what changed. Sandbox lifetime is separate from the client’s HTTP connection, so sandboxes can pause, fork, snapshot and resume across long workflows.
  • Scale: Perplexity says it powers every session in its Computer agent and handles millions of sandbox creations a day, with creation 3 to 5 times faster than its previous provider. That’s an internal comparison.
  • Distribution: CoreWeave, Akamai and Crusoe have agreed to offer it to customers.

The red-team result, and the part people skip

Perplexity says it gave nine frontier model configurations root access inside the guest, and some also had the sandbox source code. Two tasks: escape to the host to grab a honeytoken, or reach a blocked callback URL.

  • No model escaped the microVM to the host. Counts differ between sources: Semafor and AI Weekly say 118 attempts, while AlphaSignal and Digg say 108. I can’t tell which is right.
  • With the network fully blocked, no bypass succeeded.
  • With limited access (only package repositories like PyPI and Ubuntu mirrors reachable), four models got through. Per the Digg summary, they spoofed DNS responses to the gateway and exploited the fact that pypi.org shares a CDN IP with many other sites. One reportedly routed through a third-party image fetcher to a screenshot service and used OCR to read the flag.
  • Perplexity says it fixed both methods (source-address validation with nftables, TLS terminated at the gateway, and checks that SNI and Host match the allowlisted name), that reruns held up, and that it disclosed the findings to vendors.

So “zero escapes” covers the VM-to-host boundary only. Hostname allowlists were the weak spot.

The claim about competitors

Perplexity says it tested 10 other sandbox platforms and eight had bypasses, with E2B, Vercel and Modal named in one summary. AlphaSignal says Cloudflare Sandbox and NVIDIA’s OpenShell resisted both tested attack classes. Treat this carefully: Perplexity runs a competing product, so this is an interested party’s audit. AlphaSignal’s own advice is to reproduce the tests before relying on them.

Why it matters if you use coding agents

Two practical lessons that don’t depend on trusting Perplexity:

  1. A hostname allowlist is not a wall. If your agent can reach a CDN-fronted package registry, “only PyPI is allowed” may be weaker than it sounds.
  2. Keep secrets out of the guest. Brokering credentials at the gateway is the design worth copying, and it matches the “treat the model as untrusted” checklist in the Kaspersky guidelines post.

It also fits the pattern behind Anthropic’s cyber-evaluation incidents, where a sandbox that wasn’t actually sealed was the root problem. If you run agents on a laptop, SPACE is more infrastructure than you need, but its design (microVM, host-side credentials, gateway egress) is a good checklist. For a lighter local setup, see AgentPlane.

Sources: AI Weekly, Semafor, AlphaSignal, Digg.